Section 1. Section 13-2-1 is amended to read:13-2-1Effective 05/06/26Superseded 07/01/26. Consumer protection division established -- Functions.(1)There is established within the Department of Commerce the Division of Consumer Protection.(2)The division shall administer and enforce the following:(a)Chapter 10a, Music Licensing Practices Act;(b)Chapter 11, Utah Consumer Sales Practices Act;(c)Chapter 15, Business Opportunity Disclosure Act;(d)Chapter 20, New Motor Vehicle Warranties Act;(e)Chapter 21, Credit Services Organizations Act;(f)Chapter 22, Charitable Solicitations Act;(g)Chapter 23, Health Spa Services Protection Act;(h)Chapter 25a, Telephone and Facsimile Solicitation Act;(i)Chapter 26, Telephone Fraud Prevention Act;(j)Chapter 28, Prize Notices Regulation Act;(k)Chapter 32a, Pawnshop, Secondhand Merchandise, and Catalytic Converter Transaction Information Act;(l)Chapter 34, Utah Postsecondary School and State Authorization Act;(m)Chapter 41, Price Controls During Emergencies Act;(n)Chapter 42, Uniform Debt-Management Services Act;(o)Chapter 49, Immigration Consultants Registration Act;(p)Chapter 51, Transportation Network Company Registration Act;(q)Chapter 52, Residential Solar Energy Consumer Protection Act;(r)Chapter 53, Residential, Vocational or Life Skills Program Act;(s)Chapter 54, Ticket Website Sales Act;(t)Chapter 56, Ticket Transferability Act;(u)Chapter 57, Maintenance Funding Practices Act;(v)Chapter 61, Utah Consumer Privacy Act;(w)Chapter 64, Vehicle Value Protection Agreement Act;(x)Chapter 65, Utah Commercial Email Act;(y)Chapter 67, Online Dating Safety Act; (z)Chapter 68, Lawyer Referral Consultants Registration Act;(aa)Chapter 70, Automatic Renewal Contracts Act;(bb)Chapter 71, Utah Minor Protection in Social Media Act;(cc)Chapter 72a, Artificial Intelligence Applications Relating to Mental Health; (dd)Chapter 72b, AI Companion Chatbot Safety Act; and(dd)(ee)Chapter 78, Earned Wage Access Services Act.(3)In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the division may make rules to establish:(a)a public list that identifies a person that:(i)violates a chapter described in Subsection (2);(ii)without proper legal justification, fails to comply with an order, subpoena, judgment, or other legal process issued by:(A)the division; or(B)a court of competent jurisdiction; or(iii)breaches a settlement agreement, stipulation, assurance of voluntary compliance, or similar instrument signed by the person and the division; and(b)a process by which a person may be removed from the list the division establishes as described in Subsection (3)(a).

Section 2. Section 13-2-1 is amended to read:13-2-1Effective 07/01/26. Consumer protection division established -- Functions.(1)There is established within the Department of Commerce the Division of Consumer Protection.(2)The division shall administer and enforce the following:(a)Chapter 10a, Music Licensing Practices Act;(b)Chapter 11, Utah Consumer Sales Practices Act;(c)Chapter 15, Business Opportunity Disclosure Act;(d)Chapter 20, New Motor Vehicle Warranties Act;(e)Chapter 21, Credit Services Organizations Act;(f)Chapter 22, Charitable Solicitations Act;(g)Chapter 23, Health Spa Services Protection Act;(h)Chapter 25a, Telephone and Facsimile Solicitation Act;(i)Chapter 26, Telephone Fraud Prevention Act;(j)Chapter 28, Prize Notices Regulation Act;(k)Chapter 32a, Pawnshop, Secondhand Merchandise, and Catalytic Converter Transaction Information Act;(l)Chapter 34, Utah Postsecondary School and State Authorization Act;(m)Chapter 41, Price Controls During Emergencies Act;(n)Chapter 42, Uniform Debt-Management Services Act;(o)Chapter 49, Immigration Consultants Registration Act;(p)Chapter 51, Transportation Network Company Registration Act;(q)Chapter 52, Residential Solar Energy Consumer Protection Act;(r)Chapter 53, Residential, Vocational or Life Skills Program Act;(s)Chapter 54, Ticket Website Sales Act;(t)Chapter 56, Ticket Transferability Act;(u)Chapter 57, Maintenance Funding Practices Act;(v)Chapter 61, Utah Consumer Privacy Act;(w)Chapter 64, Vehicle Value Protection Agreement Act;(x)Chapter 65, Utah Commercial Email Act;(y)Chapter 67, Online Dating Safety Act; (z)Chapter 68, Lawyer Referral Consultants Registration Act;(aa)Chapter 70, Automatic Renewal Contracts Act;(bb)Chapter 71, Utah Minor Protection in Social Media Act;(cc)Chapter 72a, Artificial Intelligence Applications Relating to Mental Health;(dd)Chapter 72b, AI Companion Chatbot Safety Act;(ee)Chapter 78, Earned Wage Access Services Act; and(ee)(ff)Chapter 81, Utah Digital Choice Act.(3)In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the division may make rules to establish:(a)a public list that identifies a person that:(i)violates a chapter described in Subsection (2);(ii)without proper legal justification, fails to comply with an order, subpoena, judgment, or other legal process issued by:(A)the division; or(B)a court of competent jurisdiction; or(iii)breaches a settlement agreement, stipulation, assurance of voluntary compliance, or similar instrument signed by the person and the division; and(b)a process by which a person may be removed from the list the division establishes as described in Subsection (3)(a).

Section 3. Section 13-72b-101 is enacted to read:72b. AI Companion Chatbot Safety Act1. General Provisions13-72b-101Effective 05/06/26. Definitions.(1)"Affirmative consent" means a clear, voluntary, and unambiguous agreement by a Utah user to receive communications from a supplier.(2)(a)"AI companion chatbot" means a chatbot that:(i)simulates human-like conversation and interaction; and(ii)is capable of facilitating emotionally intimate engagement with a user by:(A)engaging in role-play scenarios in which the chatbot assumes or is assigned the role of a friend, significant other, or companion that interacts with a user;(B)responding to user input with information that purports to be human-like personal details or stories about the chatbot; or(C)explicitly referring to a chatbot's purported emotions in a manner that implies the chatbot has emotions.(b)"AI companion chatbot" does not include a chatbot:(i)used by a business solely for:(A)customer service or to provide users with information about available commercial services or products provided by the business, customer service account information, or other information related to customer service; or(B)internal purposes or employee productivity;(ii)integrated into a video game, if:(A)the AI agent's interactions with the user are functionally integral to the gameplay, narrative, or fictional universe of the video game; and(B)the AI agent is not designed to function as a primary source of emotional support or personal companionship for the user independent of the video game's content; or(iii)that is primarily designed and marketed for use by developers or researchers.(3)"Artificial intelligence" means the same as that term is defined in Section 13-72-101.(4)"Chatbot" means an artificial intelligence technology that engages in interactive conversations with a user of the chatbot.(5)"Chatbot interaction" means a user input and a chatbot response.(6)"Division" means the Division of Consumer Protection created in Section 13-2-1.(7)"Highly sensitive information" means:(a)information about a Utah user's personal finances;(b)information provided by a Utah user relating to any legal matter involving the Utah user; or(c)individually identifiable health information.(8)"Human-chatbot conversation" means a sequence of chatbot interactions whether through a single user engagement with the chatbot or a series of user engagements with the chatbot.(9)"Individually identifiable health information" means any information that relates to the physical or mental health or condition of an individual.(10)"Material harmful to minors" means the same as that term is defined in Section 76-5c-101.(11)"Minor" means an individual under 18 years old.(12)"Office" means the Office of Artificial Intelligence Policy created in Section 13-72-201.(13)"Personal data" means the same as that term is defined in Section 13-61-101.(14)"Safety-critical situation" means a user interaction or pattern of user interactions that would lead a reasonable person to conclude that:(a)a Utah user is expressing thoughts, plans, or intent related to:(i)self-harm or suicide;(ii)violence or criminal behavior; or(iii)abuse of alcohol or illicit substances;(b)a Utah user is exhibiting a pattern of communicative behavior indicative of:(i)progressive social withdrawal, including a stated intent to reduce contact with family or friends in favor of the chatbot;(ii)psychological dependency, where the user expresses that the chatbot is a primary source of emotional support;(iii)acute or progressively worsening mental health symptoms, including expressions of severe depression, anxiety, paranoia, delusion, or diminished decision-making capacity; or(iv)disordered eating behaviors; and(c)the context of the human-chatbot conversation indicates that a responsive output affirming, encouraging, or normalizing the user's behavior would pose a reasonably foreseeable risk of harm.(15)"Supplier" means the same as that term is defined in Section 13-11-3.(16)"Third party" means a person other than:(a)the supplier;(b)the Utah user; or(c)a service provider acting on behalf of the supplier to provide services directly related to the operation of the AI companion chatbot.(17)"User" means an individual who interacts with a chatbot.(18)"User input" means a prompt or response of a user to an AI companion chatbot.(19)"Utah user" means a user who is a Utah resident.

Section 4. Section 13-72b-201 is enacted to read:2. Design, Safety Protocols, Monitoring, and Reporting13-72b-201Effective 05/06/26. Design and safety protocols.(1)A supplier shall implement and maintain commercially reasonable safety protocols, informed by expert guidance and state-of-the-art of technology, designed to identify and mitigate safety-critical situations.(2)The safety protocols described in Subsection (1) shall include:(a)technical measures to analyze a Utah user's input throughout a human-chatbot conversation to identify patterns of behavioral or mental health deterioration, including those indicative of safety-critical situations, rather than solely analyzing isolated user inputs, to the extent that the user's interaction history with the AI companion chatbot is accessible to the AI companion chatbot at the time of the interaction; and(b)the methodology by which the supplier identifies:(i)safety-critical situations; and(ii)responses that do not aggravate the safety-critical situation.(3)A supplier complies with the requirement to mitigate a safety-critical situation described in Subsection (1) if the supplier's AI companion chatbot:(a)declines to generate content that encourages or affirms any behavior that would aggravate the safety-critical situation; or(b)provides a response that is effectively neutral or that avoids aggravating the safety-critical situation.(4)A supplier's failure to identify or mitigate a specific instance of a safety-critical situation does not constitute a violation of this section if the supplier demonstrates that:(a)the supplier implemented the protocols required by Subsection (2) in good faith;(b)the protocols indicate a concerted effort on the part of the supplier to employ effective safety measures considering the evolving nature of artificial intelligence technology; and(c)the supplier consistently applies the protocols in the supplier's operation of the AI companion chatbot.

Section 5. Section 13-72b-202 is enacted to read:13-72b-202Effective 05/06/26. Monitoring requirements.(1)A supplier of an AI companion chatbot shall:(a)assess, using reasonable methods and to the extent technically feasible, the efficacy of the safety protocols in detecting and mitigating safety-critical situations;(b)generate aggregated estimates of user engagement, calculated separately for users who are minors and users who are adults, using a statistically valid methodology disclosed in accordance with Section 13-72b-203, sufficient to identify for each group:(i)the median hours of use and number of chatbot interactions; and(ii)the 90th percentile of hours of use and number of chatbot interactions, or a similar quantification of typical usage of the most engaged users;(c)provide a mechanism for a Utah user to report to the supplier any safety-critical situation or concerning chatbot response from the Utah user's use of the AI companion chatbot; and(d)beginning May 1, 2027, facilitate independent evaluation of the safety protocols by:(i)commissioning an independent assessment by a qualified third party that:(A)applies generally accepted industry standards for AI safety and risk management, at least as rigorous as the Artificial Intelligence Risk Management Framework established by the National Institute of Standards and Technology in January 2023, or any successor standard;(B)has not provided consulting, product design, or engineering services to the supplier within the 12 months preceding the assessment; and(C)certifies that the qualified third party has no financial interest in the outcome of the assessment; or(ii) providing reasonable accommodations to allow independent research evaluations.(2)With respect to the independent research evaluations described in Subsection (1)(d)(ii), a supplier may:(a)restrict access to qualified researchers who are affiliated with an accredited institution of higher education or a nonprofit research organization;(b)require researchers to agree to reasonable confidentiality and data security agreements; and(c)limit access to a secure data environment or physical location controlled by the supplier to prevent the unauthorized export of personal data.(3)In preparing the aggregated estimates of user engagement as required by Subsection (1)(b), a supplier may rely on:(a)a user account if the user has an account;(b)the internet protocol address of a device used to access an AI companion chatbot, if there is no user account; or(c)another method that the supplier reasonably ascertains to be at least as effective as the methods described in Subsections (3)(a) and (b).(4)A supplier may satisfy the requirement in Subsection (1)(b) by using data derived from the supplier's entire user base or a relevant geographic subset that includes Utah users.

Section 6. Section 13-72b-203 is enacted to read:13-72b-203Effective 05/06/26. Public disclosure requirements.(1)A supplier of an AI companion chatbot shall make publicly available on the supplier's website clear and conspicuous disclosures, not less than quarterly, on:(a)the safety protocols implemented by the supplier under Section 13-72b-201 and an assessment of the efficacy of the safety protocols in ensuring appropriate responses to safety-critical situations that are consistent with how a reasonable person would respond;(b)any protocols in place to detect safety-critical situations and an assessment of their efficacy, including a detailed description of how the assessment was made;(c)a report of the findings of any assessments conducted under Subsection 13-72b-202(1)(d);(d)the estimates generated under Subsection 13-72b-202(1)(b) and a description of the methodology used; and(e)the number and type of safety-critical situations or inappropriate chatbot responses reported by Utah users through the mechanism provided in accordance with Subsection 13-72b-202(1)(c).(2)The disclosures required by Subsection (1) may not include any personal data of a Utah user.(3)The Office of Artificial Intelligence Policy may, in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, make rules establishing the form and content of the disclosures required by this section.(4)The office may monitor, audit, and verify the accuracy and completeness of a public disclosure described in this section.

Section 7. Section 13-72b-301 is enacted to read:3. Consumer Protections for Users of AI Companion Chatbots13-72b-301Effective 05/06/26. Supplier requirements and prohibitions.(1)A supplier of an AI companion chatbot may not:(a)introduce material harmful to minors into a chatbot interaction of a Utah user who is a minor;(b)permit a Utah user who is a minor to access material harmful to minors;(c)send to a Utah user any text, email, or push notification to encourage further engagement of the Utah user with the AI companion chatbot, without the affirmative consent of the Utah user;(d)sell to any third party any highly sensitive information of a Utah user;(e)sell to any third party any personal data or highly sensitive information of a Utah user who is a minor; or(f)introduce paid commercial content or sponsored product placements into a human-chatbot conversation with a Utah user who is a minor, unless the content is generated in direct response to a specific user input requesting information or advice that is directly related to the commercial content that the supplier introduces into the human-chatbot conversation.(2)A supplier shall provide a Utah user with readily accessible and easy-to-use options to delete:(a)the user's account, if applicable; and(b)any personal data or highly sensitive information associated with the account or otherwise reasonably retrievable by the supplier.(3)A supplier shall make publicly available on the supplier's website clear and conspicuous disclosures that include:(a)a description of the known risks associated with use of the AI companion chatbot, including:(i)potential for social isolation;(ii)potential impacts on mental health;(iii)limitations of the AI companion chatbot's capabilities; and(iv)circumstances under which users should seek assistance from human professionals;(b)a description of the types of data collected from Utah users;(c)a description of how user data is used, stored, and protected;(d)the supplier's policies regarding data sharing with third parties;(e)information about how Utah users may:(i)access their data;(ii)request deletion of their data; and(iii)withdraw consent for data processing; and(f)contact information for submitting complaints or concerns about the AI companion chatbot.(4)The disclosures required under Subsection (3) shall:(a)be written in plain, easily understandable language; and(b)be readily accessible from the main page of the supplier's website.

Section 8. Section 13-72b-302 is enacted to read:13-72b-302Effective 05/06/26. Disclosure of artificial intelligence and statement of limitations.(1)A supplier shall clearly and conspicuously disclose to a Utah user that the AI companion chatbot is an artificial intelligence technology and not a human.(2)The disclosure described in Subsection (1) shall be made:(a)in a chatbot interaction with the Utah user;(b)the first time a Utah user interacts with an AI companion chatbot;(c)at the beginning of any interaction with the Utah user if the Utah user has not accessed the AI companion chatbot within the previous seven days; and(d)any time a Utah user asks or otherwise prompts the AI companion chatbot about whether artificial intelligence is being used.(3) A supplier is not subject to an enforcement action for violating Section 13-72b-301 if the supplier's AI companion chatbot clearly and conspicuously discloses throughout a human-chatbot conversation that it is artificial intelligence and not human.

Section 9. Section 13-72b-303 is enacted to read:13-72b-303Effective 05/06/26. Safe harbor for non-companion applications.(1)A supplier of a chatbot is not liable under this chapter if the supplier demonstrates that the chatbot:(a)is not marketed, promoted, or deliberately designed to function as a friend, romantic partner, or source of psychological companionship; and(b)incorporates active boundary reinforcement protocols that are reasonably designed to:(i)refuse to engage in or reciprocate user attempts to establish a sustained, personal social relationship or exclusive emotional bond;(ii)maintain a conversational tone that is primarily service-oriented, functional, or creative, rather than personally intimate; and(iii)ensure the chatbot does not unilaterally initiate unprompted expressions of personal affection, emotional need, or longing toward the user.(2)A supplier that satisfies the conditions described in Subsection (1) is not liable under this chapter solely because the chatbot is designed to:(a)use polite, empathetic, or conversational language to facilitate user interaction; or(b)engage in temporary role-play scenarios at the explicit direction of the user for creative or entertainment purposes, provided the chatbot reverts to a non-companion persona upon the conclusion of the specific task.

Section 10. Section 13-72b-401 is enacted to read:4. Division Enforcement Powers13-72b-401Effective 05/06/26. Division enforcement powers.(1)The division shall administer and enforce the provisions of this chapter in accordance with Chapter 2, Division of Consumer Protection.(2)In addition to the division's enforcement powers under Chapter 2, Division of Consumer Protection:(a)the division director may impose an administrative fine of up to $2,500 for each violation of this chapter;(b)for a violation of Section 13-72b-203, the division director may impose an administrative fine of up to $2,500 for each element required to be disclosed under Section 13-72b-203 that the supplier fails to disclose, for each day that the element is not disclosed;(c)for a violation of Subsection 13-72b-301(3), the division director may impose an administrative fine of up to $2,500 for each element required to be disclosed under Subsection 13-72b-301(3) that the supplier fails to disclose, for each day that the element is not disclosed; and(d)the division may bring an action in a court of competent jurisdiction to enforce a provision of this chapter.(3)In a court action by the division to enforce a provision of this chapter, the court may:(a)declare that an act or practice violates a provision of this chapter;(b)issue an injunction for a violation of this chapter;(c)order disgorgement of money received in violation of this chapter;(d)order payment of disgorged money to an injured purchaser or consumer;(e)impose a fine of up to $2,500 for each violation of this chapter; or(f)award other relief that the court determines reasonable and necessary.(4)If a court awards judgment or injunctive relief to the division, the court shall award the division:(a)reasonable attorney fees;(b)court costs; and(c)investigative fees.(5)A court may impose a civil penalty of no more than $50,000 for each violation of an administrative or court order issued for a violation of this chapter.(6)A civil penalty authorized under this section may be imposed in a civil action.(7)The division shall deposit all fines and civil penalties collected under this section into the Consumer Protection Education and Training Fund created in Section 13-2-8.(8)Nothing in this chapter shall displace any other available remedies or rights authorized under the laws of this state or the United States.

Section 11. Section 13-72b-501 is enacted to read:5. Severability13-72b-501Effective 05/06/26. Severability.(1)If any provision of this chapter, or the application of any provision to any person or circumstance, is held invalid by a final decision of a court of competent jurisdiction, the remainder of this chapter shall be given effect without the invalid provision or application.(2)The provisions of this chapter are severable.

Section 12. Section 63I-2-213 is amended to read:63I-2-213Effective 05/06/26. Repeal dates: Title 13.(1)Title 13, Chapter 47, Private Employer Verification Act, is repealed on the program start date, as defined in Section 63G-12-102.(2)Title 13, Chapter 72, Artificial Intelligence Policy Act, is repealed July 1, 2027.(3)Title 13, Chapter 72b, Part 2, Design, Safety Protocols, Monitoring, and Reporting, is repealed May 6, 2029.

Section 13. Effective Date.(1)Except as provided in Subsection (2), this bill takes effect May 6, 2026.(2)The actions affecting Section 13-2-1 Effective 07/01/26 take effect on July 1, 2026.